Add Grok and Kiro sign-in to config login

apps/desktop-tauri/src-tauri/src/commands/grok_accounts.rs

@@ -49,9 +49,8 @@ pub async fn grok_account_add(app: tauri::AppHandle) -> Result<(), String> {
         .await
         .map_err(|e| e.to_string())?
         .map_err(|e| e.to_string())?;
-    let _credentials = accounts::CREDENTIAL_OPERATION.lock().await;
-    AccountManager::new()
-        .and_then(|m| m.import(login))
+    accounts::save_login(login)
+        .await
         .map_err(|e| e.to_string())?;
     crate::auto_resume::clear(&app, ProviderId::Grok);
     changed(&app);

apps/desktop-tauri/src-tauri/src/commands/system.rs

@@ -343,6 +343,7 @@ async fn run_cli_provider_login(
         )),
         LoginOutcome::LaunchFailed(e) => Err(format!("Failed to launch {display_name} login: {e}")),
         LoginOutcome::TimedOut => Err(format!("{display_name} login timed out")),
+        LoginOutcome::Cancelled => Err(format!("{display_name} login cancelled")),
         LoginOutcome::Failed { status } => Err(format!(
             "{display_name} login failed with exit code {status}"
         )),

docs/CLI.md

@@ -362,7 +362,7 @@ codexbar config validate
 | `enable`, `disable` | Turns a provider on or off and saves the setting. |
 | `set-source` | Saves a provider's usage source (`--source auto\|web\|cli\|oauth`) without changing whether it is enabled. `auto` returns to the default. |
 | `set-api-key` | Stores a provider API key. `--stdin` reads it from stdin. `--no-enable` stores it without enabling the provider. |
-| `login` | Signs in to GitHub Copilot with GitHub's device-code flow. Only `--provider copilot` is supported. See [Sign in to Copilot from the CLI](#sign-in-to-copilot-from-the-cli). |
+| `login` | Signs in to GitHub Copilot with GitHub's device-code flow, or to Grok and Kiro through their own CLIs. Other providers are rejected. See [Sign in from the CLI](#sign-in-from-the-cli). |
 | `path` | Shows the configuration file paths. |
 | `preferences export`, `preferences import` | Exports or imports portable preferences. See [CONFIGURATION.md](./CONFIGURATION.md#portable-preferences). |
 | `claude-code-credentials` | `allow`, `deny` or `status`. |
@@ -382,14 +382,19 @@ codexbar config validate
 
 `config preferences import` changes the saved settings. Restart a running CodexBar afterwards.
 
-### Sign in to Copilot from the CLI
+### Sign in from the CLI
 
 ```powershell
 codexbar config login --provider copilot
-codexbar config login --provider copilot --json
+codexbar config login --provider grok
+codexbar config login --provider kiro --json
 ```
 
-`config login` starts GitHub's device-code flow for GitHub Copilot. It prints the verification URL and a one-time code, then waits while you approve the code in your browser. The code expires after the lifetime GitHub returns, and the command stops when it does.
+`config login` supports three providers: `copilot`, `grok` and `kiro`. The output and exit codes are the same for all three. Each provider's own sign-in differs, as described below.
+
+#### GitHub Copilot
+
+`config login --provider copilot` starts GitHub's device-code flow. It prints the verification URL and a one-time code, then waits while you approve the code in your browser. The code expires after the lifetime GitHub returns, and the command stops when it does.
 
 Text output is two lines and then a confirmation:
 
@@ -403,35 +408,52 @@ The token is never printed. Once you approve the code, the account is saved the
 
 A successful login also turns the Copilot provider on in settings, as the macOS app does. The desktop app's sign-in does not change the enabled state, so enable Copilot there yourself if you use that path.
 
+#### Grok
+
+`config login --provider grok` runs `grok login --oauth` from Grok Build, the same sign-in the desktop app's Grok account add uses. Grok opens the browser itself, so the CLI prints only `Waiting for the browser sign-in to finish.` (in JSON, an `authorization_pending` line with no URL). Grok's own output is not shown. The sign-in waits up to 5 minutes.
+
+Once the sign-in finishes, the account is saved to CodexBar's Grok accounts the same way the desktop app saves it. Then the Grok provider is turned on. If the Grok CLI is not installed, the command exits with `8`. Set `CODEXBAR_GROK_CLI_PATH` to a `grok` executable to use that file; the variable is used only when it names an existing file.
+
+#### Kiro
+
+`config login --provider kiro` runs `kiro-cli login`. The command first prints `Waiting for the browser sign-in to finish.` (in JSON, an `authorization_pending` line with no URL). kiro-cli then prints a sign-in link and opens the browser. The link is printed as soon as the CLI shows it: on its own line in text mode, or as a second `authorization_pending` line with `verificationURI` in JSON mode. The sign-in waits up to 120 seconds, the same as the desktop sign-in.
+
+kiro-cli keeps the credential itself. CodexBar does not copy it into its own store. A zero exit code therefore means kiro-cli reported a successful sign-in. Then the Kiro provider is turned on. If kiro-cli is not installed, the command exits with `8`. `CODEXBAR_KIRO_CLI_PATH` selects a specific `kiro-cli` executable, as it does for usage.
+
+#### JSON events
+
 `--json` prints one JSON object per line, using upstream's field names:
 
 | Line | Shape |
 | --- | --- |
-| Code issued | `{"status":"authorization_pending","verificationURI":"https://github.com/login/device","userCode":"ABCD-1234","expiresIn":900}` |
-| Approved and saved | `{"status":"authorized"}`. This line is written only after the account is saved and Copilot is enabled. |
+| Code issued (Copilot) | `{"status":"authorization_pending","verificationURI":"https://github.com/login/device","userCode":"ABCD-1234","expiresIn":900}` |
+| Kiro sign-in link | `{"status":"authorization_pending","verificationURI":"<link printed by kiro-cli>"}` |
+| Waiting in the browser (Grok; also the first line for Kiro) | `{"status":"authorization_pending"}` |
+| Approved and saved | `{"status":"authorized"}`. This line is written only after the credential is saved and the provider is enabled. |
 | Cancelled (Ctrl-C) | `{"status":"cancelled"}` |
-| Failed | `{"status":"failed","reason":"denied","error":"GitHub device login failed: Access denied by user"}`. `reason` is one of the values in the exit code table below. |
+| Failed | `{"status":"failed","reason":"denied","error":"GitHub device login failed: Access denied by user"}`. `reason` is one of `denied`, `expired`, `cancelled`, `missing_binary` or `error`. The exit code table below maps each reason to its exit code. |
 
-Text mode prints the URL and code, then `Connected` on success. Errors go to stderr as `Error: <message>`. Ctrl-C ends the login with `Error: Login cancelled.` and exit code `7`.
+Text mode prints the URL and code for Copilot. Grok prints only `Waiting for the browser sign-in to finish.` Kiro prints that waiting line, then the sign-in URL once kiro-cli shows it. On success every provider prints `Connected`. Errors go to stderr as `Error: <message>`. Ctrl-C ends the login with `Error: Login cancelled.` and exit code `7`.
 
 ### Exit codes
 
 | Exit code | Meaning | Final `--json` line |
 | --- | --- | --- |
-| `0` | Signed in. The account is saved and Copilot is enabled. | `{"status":"authorized"}` |
-| `1` | Any other failure: network error, GitHub server error, or a settings or token store write error. Usually nothing is saved. If only the settings write that enables Copilot fails, the account is already saved and the error says `Signed in and saved the account, but could not enable Copilot`; running the login again updates that account. | `{"status":"failed","reason":"error",...}` |
-| `5` | The user denied the request on GitHub (`access_denied`). Nothing is saved. | `{"status":"failed","reason":"denied",...}` |
-| `6` | The device code expired before approval (`expired_token`). Nothing is saved. | `{"status":"failed","reason":"expired",...}` |
-| `7` | Stopped with Ctrl-C before the account was saved. Nothing is saved. | `{"status":"cancelled"}` |
+| `0` | Signed in. The credential is saved (Copilot and Grok) or kiro-cli reported success (Kiro), and the provider is enabled. | `{"status":"authorized"}` |
+| `1` | Any other failure: network error, provider server error, or a settings or store write error. Usually nothing is saved. If only the settings write that enables the provider fails, the sign-in already finished and the error says so: `Signed in and saved the account, but could not enable Copilot` (or `Grok`), or `Signed in, but could not enable Kiro`. Running the login again updates that account. | `{"status":"failed","reason":"error",...}` |
+| `5` | The user denied the request on GitHub (`access_denied`). Copilot only. Nothing is saved. | `{"status":"failed","reason":"denied",...}` |
+| `6` | The sign-in expired before approval: the GitHub device code (`expired_token`), or the Grok or Kiro sign-in window ran out. Nothing is saved. | `{"status":"failed","reason":"expired",...}` |
+| `7` | Stopped with Ctrl-C before the credential was saved. Nothing is saved. | `{"status":"cancelled"}` |
+| `8` | The provider's CLI is not installed: `grok` (Grok) or `kiro-cli` (Kiro). Copilot never uses this code. Nothing is saved. | `{"status":"failed","reason":"missing_binary",...}` |
 | `64` | Invalid arguments, including an unsupported `--provider`. No network call is made. | None; the error goes to stderr |
 
-Only exit code `0` guarantees both that the credential was saved and that Copilot is enabled. Codes `5`, `6`, `7` and `64` mean nothing was saved; code `1` can follow a saved account, as described above.
+Only exit code `0` guarantees both that the sign-in finished and that the provider is enabled. For Kiro, kiro-cli keeps the credential, so `0` means kiro-cli reported a successful sign-in. Codes `5`, `6`, `7`, `8` and `64` mean nothing was saved; code `1` can follow a finished sign-in, as described above.
 
 Polling follows the interval GitHub returns. Each `slow_down` response adds 5 seconds for the rest of the login. GitHub's `access_denied` and `expired_token` responses end the login with the friendly errors above, and nothing is saved.
 
-Other providers fail before any network call: `Login is only supported for copilot. Use --provider copilot.`
+Other providers fail before any network call: `Login is supported for copilot, grok and kiro. Use --provider copilot, grok or kiro.`
 
-The login always signs in on github.com. This port has no GitHub Enterprise host option for the login flow, and the desktop app's sign-in behaves the same way.
+The Copilot login always signs in on github.com. This port has no GitHub Enterprise host option for the login flow, and the desktop app's sign-in behaves the same way.
 
 For tests and proof runs, `CODEXBAR_GITHUB_BASE_URL` replaces both GitHub roots with one origin. The device-code requests (`/login/device/code`, `/login/oauth/access_token`) and the identity and usage requests (`/user`, `/copilot_internal/user`) all go there. Only `https://` URLs, or loopback `http://` URLs (`127.0.0.1`, `localhost`, `[::1]`), with no path, query or credentials are accepted. Anything else is ignored with a warning, and the default GitHub roots are used. The variable also applies to the desktop app's Copilot sign-in and usage fetches, so unset it for normal use.
 

rust/examples/fake_grok_cli.rs

@@ -0,0 +1,24 @@
+//! Scripted stand-in for `grok login --oauth --leader-socket <path>`, used by
+//! the CLI proof runs. It never writes a login file, so it cannot touch the
+//! real Grok account store.
+//!
+//! The mode comes from the `FAKE_GROK_MODE` environment variable:
+//! - `wait` (default): sleeps as if the browser sign-in were still open.
+//! - `fail`: exits 3 without signing in.
+//!
+//! This is a cargo example, not a shipped binary. `cargo test` builds it into
+//! `target/<profile>/examples`.
+
+use std::process::ExitCode;
+use std::thread;
+use std::time::Duration;
+
+fn main() -> ExitCode {
+    match std::env::var("FAKE_GROK_MODE").unwrap_or_default().as_str() {
+        "fail" => ExitCode::from(3),
+        _ => {
+            thread::sleep(Duration::from_secs(60));
+            ExitCode::SUCCESS
+        }
+    }
+}

rust/examples/fake_kiro_cli.rs

@@ -0,0 +1,44 @@
+//! Scripted stand-in for `kiro-cli login`, used by the login runner tests and
+//! the CLI proof runs.
+//!
+//! Usage: `fake_kiro_cli login <mode>`, or `fake_kiro_cli login` with the mode
+//! in the `FAKE_KIRO_MODE` environment variable (what `config login` runs).
+//!
+//! Modes:
+//! - `success`: prints a sign-in URL and the success marker, then exits 0.
+//! - `wait`: prints a sign-in URL, then waits for the browser (sleeps).
+//! - `silent`: prints nothing and sleeps.
+//! - anything else: exits 3.
+//!
+//! This is a cargo example, not a shipped binary. `cargo test` builds it next to
+//! the test binary, so no dependency or PATH setup is needed.
+
+use std::process::ExitCode;
+use std::thread;
+use std::time::Duration;
+
+const SIGN_IN_URL: &str = "https://example.com/device?code=ABCD-1234";
+
+fn main() -> ExitCode {
+    let mode = std::env::args()
+        .nth(2)
+        .or_else(|| std::env::var("FAKE_KIRO_MODE").ok())
+        .unwrap_or_default();
+    match mode.as_str() {
+        "success" => {
+            println!("Open {SIGN_IN_URL} to continue");
+            println!("Successfully logged in");
+            ExitCode::SUCCESS
+        }
+        "wait" => {
+            println!("Open {SIGN_IN_URL} to continue");
+            thread::sleep(Duration::from_secs(60));
+            ExitCode::SUCCESS
+        }
+        "silent" => {
+            thread::sleep(Duration::from_secs(60));
+            ExitCode::SUCCESS
+        }
+        _ => ExitCode::from(3),
+    }
+}

rust/src/cli/config.rs

@@ -18,6 +18,7 @@ use crate::providers::copilot::login::{
 };
 use crate::settings::{ApiKeys, ManualCookies, PreferencesDocument, Settings};
 
+mod cli_login;
 mod login;
 
 pub use login::ConfigLoginError;
@@ -86,7 +87,7 @@ pub enum ConfigCommand {
         #[arg(long = "no-enable")]
         no_enable: bool,
     },
-    /// Log in to a provider through its own device flow (GitHub Copilot only)
+    /// Log in to a provider through its own sign-in (GitHub Copilot, Grok, Kiro)
     Login {
         #[command(flatten)]
         target: ConfigProviderArg,
@@ -793,38 +794,61 @@ fn resolve_api_key_input(api_key: Option<&str>, read_from_stdin: bool) -> anyhow
     Ok(value)
 }
 
-/// Run `config login`. Only GitHub Copilot has a CLI login flow.
+/// Run `config login`. GitHub Copilot uses a device code; Grok and Kiro run
+/// their own CLI sign-in.
+///
+/// Output goes through `std::io::stdout()` rather than a held lock, because
+/// the Kiro sign-in link is written from the login thread.
 async fn login(provider: &str, output: ConfigOutputArgs) -> Result<(), ConfigLoginError> {
     let id = parse_provider(provider).map_err(ConfigLoginError::usage)?;
-    if id != ProviderId::Copilot {
-        return Err(ConfigLoginError::usage(
-            "Login is only supported for copilot. Use --provider copilot.",
-        ));
-    }
-    let flow = CopilotDeviceFlow::new();
-    let api = CopilotApi::new();
-    let store = TokenAccountStore::new();
-    run_copilot_login(
-        &flow,
-        &api,
-        &store,
-        output.is_json(),
-        &mut std::io::stdout().lock(),
-        login::ctrl_c(),
-        enable_copilot,
-    )
-    .await
-    .map(|_| ())
+    let json = output.is_json();
+    let out = &mut std::io::stdout();
+    match id {
+        ProviderId::Copilot => {
+            let flow = CopilotDeviceFlow::new();
+            let api = CopilotApi::new();
+            let store = TokenAccountStore::new();
+            run_copilot_login(&flow, &api, &store, json, out, login::ctrl_c(), || {
+                enable_provider(ProviderId::Copilot)
+            })
+            .await
+            .map(|_| ())
+        }
+        ProviderId::Grok => cli_login::login_grok(json, out).await,
+        ProviderId::Kiro => cli_login::login_kiro(json, out).await,
+        _ => Err(ConfigLoginError::usage(
+            "Login is supported for copilot, grok and kiro. Use --provider copilot, grok or kiro.",
+        )),
+    }
 }
 
-/// Turns the Copilot provider on after a saved login. Only `config login`
-/// does this; the desktop sign-in keeps its current behavior.
-fn enable_copilot() -> anyhow::Result<()> {
+/// Turns `id` on after a saved login. Only `config login` does this; the
+/// desktop sign-in keeps its current behavior.
+fn enable_provider(id: ProviderId) -> anyhow::Result<()> {
     let mut settings = Settings::load();
-    settings.enable_provider(ProviderId::Copilot);
+    settings.enable_provider(id);
     settings.save()
 }
 
+/// The error for a sign-in that finished but whose settings write failed.
+/// `saved_account` is true when CodexBar itself stored the credential, so the
+/// message tells the user the account is already there.
+fn enable_failed(
+    id: ProviderId,
+    saved_account: bool,
+    error: impl std::fmt::Display,
+) -> ConfigLoginError {
+    let done = if saved_account {
+        "Signed in and saved the account"
+    } else {
+        "Signed in"
+    };
+    ConfigLoginError::other(format!(
+        "{done}, but could not enable {}: {error}",
+        id.display_name()
+    ))
+}
+
 /// Runs the Copilot device login and writes progress to `out`. In JSON mode
 /// each event is one line; in text mode the URL and code are two lines.
 ///
@@ -846,11 +870,7 @@ async fn run_copilot_login(
         saved = copilot_steps(flow, api, store, json, out) => saved,
     };
     let result = result.and_then(|mut saved| {
-        enable().map_err(|error| {
-            ConfigLoginError::other(format!(
-                "Signed in and saved the account, but could not enable Copilot: {error}"
-            ))
-        })?;
+        enable().map_err(|error| enable_failed(ProviderId::Copilot, true, error))?;
         saved.enabled = true;
         Ok(saved)
     });